--- /dev/null
+From d45b3279a5a2252cafcd665bbf2db8c9b31ef783 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Tue, 8 Jul 2014 12:25:28 +0200
+Subject: block: don't assume last put of shared tags is for the host
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit d45b3279a5a2252cafcd665bbf2db8c9b31ef783 upstream.
+
+There is no inherent reason why the last put of a tag structure must be
+the one for the Scsi_Host, as device model objects can be held for
+arbitrary periods. Merge blk_free_tags and __blk_free_tags into a single
+funtion that just release a references and get rid of the BUG() when the
+host reference wasn't the last.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-tag.c | 33 +++++++--------------------------
+ 1 file changed, 7 insertions(+), 26 deletions(-)
+
+--- a/block/blk-tag.c
++++ b/block/blk-tag.c
+@@ -27,18 +27,15 @@ struct request *blk_queue_find_tag(struc
+ EXPORT_SYMBOL(blk_queue_find_tag);
+
+ /**
+- * __blk_free_tags - release a given set of tag maintenance info
++ * blk_free_tags - release a given set of tag maintenance info
+ * @bqt: the tag map to free
+ *
+- * Tries to free the specified @bqt. Returns true if it was
+- * actually freed and false if there are still references using it
++ * Drop the reference count on @bqt and frees it when the last reference
++ * is dropped.
+ */
+-static int __blk_free_tags(struct blk_queue_tag *bqt)
++void blk_free_tags(struct blk_queue_tag *bqt)
+ {
+- int retval;
+-
+- retval = atomic_dec_and_test(&bqt->refcnt);
+- if (retval) {
++ if (atomic_dec_and_test(&bqt->refcnt)) {
+ BUG_ON(find_first_bit(bqt->tag_map, bqt->max_depth) <
+ bqt->max_depth);
+
+@@ -50,9 +47,8 @@ static int __blk_free_tags(struct blk_qu
+
+ kfree(bqt);
+ }
+-
+- return retval;
+ }
++EXPORT_SYMBOL(blk_free_tags);
+
+ /**
+ * __blk_queue_free_tags - release tag maintenance info
+@@ -69,28 +65,13 @@ void __blk_queue_free_tags(struct reques
+ if (!bqt)
+ return;
+
+- __blk_free_tags(bqt);
++ blk_free_tags(bqt);
+
+ q->queue_tags = NULL;
+ queue_flag_clear_unlocked(QUEUE_FLAG_QUEUED, q);
+ }
+
+ /**
+- * blk_free_tags - release a given set of tag maintenance info
+- * @bqt: the tag map to free
+- *
+- * For externally managed @bqt frees the map. Callers of this
+- * function must guarantee to have released all the queues that
+- * might have been using this tag map.
+- */
+-void blk_free_tags(struct blk_queue_tag *bqt)
+-{
+- if (unlikely(!__blk_free_tags(bqt)))
+- BUG();
+-}
+-EXPORT_SYMBOL(blk_free_tags);
+-
+-/**
+ * blk_queue_free_tags - release tag maintenance info
+ * @q: the request queue for the device
+ *
--- /dev/null
+From 3b3a1814d1703027f9867d0f5cbbfaf6c7482474 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Wed, 2 Jul 2014 12:46:23 -0400
+Subject: block: provide compat ioctl for BLKZEROOUT
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 3b3a1814d1703027f9867d0f5cbbfaf6c7482474 upstream.
+
+This patch provides the compat BLKZEROOUT ioctl. The argument is a pointer
+to two uint64_t values, so there is no need to translate it.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/compat_ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/block/compat_ioctl.c
++++ b/block/compat_ioctl.c
+@@ -690,6 +690,7 @@ long compat_blkdev_ioctl(struct file *fi
+ case BLKROSET:
+ case BLKDISCARD:
+ case BLKSECDISCARD:
++ case BLKZEROOUT:
+ /*
+ * the ones below are implemented in blkdev_locked_ioctl,
+ * but we call blkdev_ioctl, which gets the lock for us
--- /dev/null
+From 3445857b22eafb70a6ac258979e955b116bfd2c6 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Mon, 16 Jun 2014 09:08:29 -0300
+Subject: media: hdpvr: fix two audio bugs
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 3445857b22eafb70a6ac258979e955b116bfd2c6 upstream.
+
+When the audio encoding is changed the driver calls hdpvr_set_audio
+with the current opt->audio_input value. However, that should have
+been opt->audio_input + 1. So changing the audio encoding inadvertently
+changes the input as well. This bug has always been there.
+
+The second bug was introduced in kernel 3.10 and that broke the
+default_audio_input module option handling: the audio encoding was
+never switched to AC3 if default_audio_input was set to 2 (SPDIF input).
+
+In addition, since starting with 3.10 the audio encoding is always set
+at the start the first bug now always happens when the driver is loaded.
+In the past this bug would only surface if the user would change the
+audio encoding after the driver was loaded.
+
+Also fixes a small trivial typo (bufffer -> buffer).
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Reported-by: Scott Doty <scott@corp.sonic.net>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/hdpvr/hdpvr-video.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/hdpvr/hdpvr-video.c
++++ b/drivers/media/usb/hdpvr/hdpvr-video.c
+@@ -82,7 +82,7 @@ static void hdpvr_read_bulk_callback(str
+ }
+
+ /*=========================================================================*/
+-/* bufffer bits */
++/* buffer bits */
+
+ /* function expects dev->io_mutex to be hold by caller */
+ int hdpvr_cancel_queue(struct hdpvr_device *dev)
+@@ -926,7 +926,7 @@ static int hdpvr_s_ctrl(struct v4l2_ctrl
+ case V4L2_CID_MPEG_AUDIO_ENCODING:
+ if (dev->flags & HDPVR_FLAG_AC3_CAP) {
+ opt->audio_codec = ctrl->val;
+- return hdpvr_set_audio(dev, opt->audio_input,
++ return hdpvr_set_audio(dev, opt->audio_input + 1,
+ opt->audio_codec);
+ }
+ return 0;
+@@ -1198,7 +1198,7 @@ int hdpvr_register_videodev(struct hdpvr
+ v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
+ V4L2_CID_MPEG_AUDIO_ENCODING,
+ ac3 ? V4L2_MPEG_AUDIO_ENCODING_AC3 : V4L2_MPEG_AUDIO_ENCODING_AAC,
+- 0x7, V4L2_MPEG_AUDIO_ENCODING_AAC);
++ 0x7, ac3 ? dev->options.audio_codec : V4L2_MPEG_AUDIO_ENCODING_AAC);
+ v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
+ V4L2_CID_MPEG_VIDEO_ENCODING,
+ V4L2_MPEG_VIDEO_ENCODING_MPEG_4_AVC, 0x3,
--- /dev/null
+From f71920efb1066d71d74811e1dbed658173adf9bf Mon Sep 17 00:00:00 2001
+From: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
+Date: Sat, 14 Jun 2014 08:37:09 -0300
+Subject: media: media: v4l2-core: v4l2-dv-timings.c: Cleaning up code wrong value used in aspect ratio
+
+From: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
+
+commit f71920efb1066d71d74811e1dbed658173adf9bf upstream.
+
+Wrong value used in same cases for the aspect ratio.
+
+Signed-off-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/v4l2-dv-timings.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -595,10 +595,10 @@ struct v4l2_fract v4l2_calc_aspect_ratio
+ aspect.denominator = 9;
+ } else if (ratio == 34) {
+ aspect.numerator = 4;
+- aspect.numerator = 3;
++ aspect.denominator = 3;
+ } else if (ratio == 68) {
+ aspect.numerator = 15;
+- aspect.numerator = 9;
++ aspect.denominator = 9;
+ } else {
+ aspect.numerator = hor_landscape + 99;
+ aspect.denominator = 100;
--- /dev/null
+From 4856fbd12d69965d3ab680c686222db93872728d Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 11 Jun 2014 11:49:31 -0300
+Subject: media: staging: tighten omap4iss dependencies
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 4856fbd12d69965d3ab680c686222db93872728d upstream.
+
+The OMAP4 camera support depends on I2C and VIDEO_V4L2, both
+of which can be loadable modules. This causes build failures
+if we want the camera driver to be built-in.
+
+This can be solved by turning the option into "tristate",
+which unfortunately causes another problem, because the
+driver incorrectly calls a platform-internal interface
+for omap4_ctrl_pad_readl/omap4_ctrl_pad_writel.
+
+Instead, this patch just forbids the invalid configurations
+and ensures that the driver can only be built if all its
+dependencies are built-in.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/omap4iss/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/media/omap4iss/Kconfig
++++ b/drivers/staging/media/omap4iss/Kconfig
+@@ -1,6 +1,6 @@
+ config VIDEO_OMAP4
+ bool "OMAP 4 Camera support"
+- depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API && I2C && ARCH_OMAP4
++ depends on VIDEO_V4L2=y && VIDEO_V4L2_SUBDEV_API && I2C=y && ARCH_OMAP4
+ select VIDEOBUF2_DMA_CONTIG
+ ---help---
+ Driver for an OMAP 4 ISS controller.
--- /dev/null
+From db4175ae2095634dbecd4c847da439f9c83e1b3b Mon Sep 17 00:00:00 2001
+From: Antti Palosaari <crope@iki.fi>
+Date: Fri, 4 Jul 2014 05:44:39 -0300
+Subject: media: tda10071: force modulation to QPSK on DVB-S
+
+From: Antti Palosaari <crope@iki.fi>
+
+commit db4175ae2095634dbecd4c847da439f9c83e1b3b upstream.
+
+Only supported modulation for DVB-S is QPSK. Modulation parameter
+contains invalid value for DVB-S on some cases, which leads driver
+refusing tuning attempt. Due to that, hard code modulation to QPSK
+in case of DVB-S.
+
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/tda10071.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/dvb-frontends/tda10071.c
++++ b/drivers/media/dvb-frontends/tda10071.c
+@@ -667,6 +667,7 @@ static int tda10071_set_frontend(struct
+ struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+ int ret, i;
+ u8 mode, rolloff, pilot, inversion, div;
++ fe_modulation_t modulation;
+
+ dev_dbg(&priv->i2c->dev, "%s: delivery_system=%d modulation=%d " \
+ "frequency=%d symbol_rate=%d inversion=%d pilot=%d " \
+@@ -701,10 +702,13 @@ static int tda10071_set_frontend(struct
+
+ switch (c->delivery_system) {
+ case SYS_DVBS:
++ modulation = QPSK;
+ rolloff = 0;
+ pilot = 2;
+ break;
+ case SYS_DVBS2:
++ modulation = c->modulation;
++
+ switch (c->rolloff) {
+ case ROLLOFF_20:
+ rolloff = 2;
+@@ -749,7 +753,7 @@ static int tda10071_set_frontend(struct
+
+ for (i = 0, mode = 0xff; i < ARRAY_SIZE(TDA10071_MODCOD); i++) {
+ if (c->delivery_system == TDA10071_MODCOD[i].delivery_system &&
+- c->modulation == TDA10071_MODCOD[i].modulation &&
++ modulation == TDA10071_MODCOD[i].modulation &&
+ c->fec_inner == TDA10071_MODCOD[i].fec) {
+ mode = TDA10071_MODCOD[i].val;
+ dev_dbg(&priv->i2c->dev, "%s: mode found=%02x\n",
--- /dev/null
+From 74adf83f5d7720925499b4938f930591f947b660 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Wed, 18 Jun 2014 11:07:03 +0200
+Subject: nfs: only show Posix ACLs in listxattr if actually present
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 74adf83f5d7720925499b4938f930591f947b660 upstream.
+
+The big ACL switched nfs to use generic_listxattr, which calls all existing
+->list handlers. Add a custom .listxattr implementation that only lists
+the ACLs if they actually are present on the given inode.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reported-by: Philippe Troin <phil@fifi.org>
+Tested-by: Philippe Troin <phil@fifi.org>
+Fixes: 013cdf1088d7 (nfs: use generic posix ACL infrastructure ...)
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs3acl.c | 43 +++++++++++++++++++++++++++++++++++++++++++
+ fs/nfs/nfs3proc.c | 4 ++--
+ 2 files changed, 45 insertions(+), 2 deletions(-)
+
+--- a/fs/nfs/nfs3acl.c
++++ b/fs/nfs/nfs3acl.c
+@@ -247,3 +247,46 @@ const struct xattr_handler *nfs3_xattr_h
+ &posix_acl_default_xattr_handler,
+ NULL,
+ };
++
++static int
++nfs3_list_one_acl(struct inode *inode, int type, const char *name, void *data,
++ size_t size, ssize_t *result)
++{
++ struct posix_acl *acl;
++ char *p = data + *result;
++
++ acl = get_acl(inode, type);
++ if (!acl)
++ return 0;
++
++ posix_acl_release(acl);
++
++ *result += strlen(name);
++ *result += 1;
++ if (!size)
++ return 0;
++ if (*result > size)
++ return -ERANGE;
++
++ strcpy(p, name);
++ return 0;
++}
++
++ssize_t
++nfs3_listxattr(struct dentry *dentry, char *data, size_t size)
++{
++ struct inode *inode = dentry->d_inode;
++ ssize_t result = 0;
++ int error;
++
++ error = nfs3_list_one_acl(inode, ACL_TYPE_ACCESS,
++ POSIX_ACL_XATTR_ACCESS, data, size, &result);
++ if (error)
++ return error;
++
++ error = nfs3_list_one_acl(inode, ACL_TYPE_DEFAULT,
++ POSIX_ACL_XATTR_DEFAULT, data, size, &result);
++ if (error)
++ return error;
++ return result;
++}
+--- a/fs/nfs/nfs3proc.c
++++ b/fs/nfs/nfs3proc.c
+@@ -926,7 +926,7 @@ static const struct inode_operations nfs
+ .getattr = nfs_getattr,
+ .setattr = nfs_setattr,
+ #ifdef CONFIG_NFS_V3_ACL
+- .listxattr = generic_listxattr,
++ .listxattr = nfs3_listxattr,
+ .getxattr = generic_getxattr,
+ .setxattr = generic_setxattr,
+ .removexattr = generic_removexattr,
+@@ -940,7 +940,7 @@ static const struct inode_operations nfs
+ .getattr = nfs_getattr,
+ .setattr = nfs_setattr,
+ #ifdef CONFIG_NFS_V3_ACL
+- .listxattr = generic_listxattr,
++ .listxattr = nfs3_listxattr,
+ .getxattr = generic_getxattr,
+ .setxattr = generic_setxattr,
+ .removexattr = generic_removexattr,